windows-service-dll-abuse

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains plaintext credentials and instructs embedding them or attacker-specific secret values verbatim into commands/payloads (e.g., "net user backdoor P@ssw0rd123", msfvenom PASS/LHOST, sc config with ATTACKER_IP), which requires the LLM to output secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, step-by-step malicious techniques for Windows privilege escalation and persistence—service binary/ACL manipulation, registry edits, DLL hijacking, and generation/deployment of reverse-shell/backdoor payloads—enabling remote code execution, backdoors, and credential/persistence abuse.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt provides step-by-step instructions to actively modify system state — changing service binaries and registry ImagePath, replacing/writing DLLs, altering ACLs, restarting services, and even adding local admin users or planting reverse shells — which directly instructs compromising the host.